Dashboards & Visualizations

Cannot identify unexpected close tag

kphansdge
Engager

Hi,

 

I am trying to make use of this dashboard from this forum thread:

Solved: Ever wonder which dashboards are being used and wh... - Splunk Community

but I am running into an error saying "Unexpected close tag" on this line:

 

<query>index="_internal" user!="-" sourcetype=splunkd_ui_access "en-US/app" | rex field=referer "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home"

 

Please advise.

 

Also I am adding this directly to the Source of a dashboard instead of a search is that right?

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

<query>index="_internal" user!="-" sourcetype=splunkd_ui_access "en-US/app" | rex field=referer "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like this might be from the source view of the dashboard, in which case, the < and > in the rex expression should be converted to &lt; and &gt; respectively, or edit the search from ui mode and paste the search in?

0 Karma

kphansdge
Engager

@ITWhisperer wrote:

It looks like this might be from the source view of the dashboard, in which case, the < and > in the rex expression should be converted to &lt; and &gt; respectively, or edit the search from ui mode and paste the search in?


Thank you for your response. I'm looking at the code and I don't see <  and > in the rex expression could you please elaborate? I'm fairly new to coding

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

<query>index="_internal" user!="-" sourcetype=splunkd_ui_access "en-US/app" | rex field=referer "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home"

0 Karma

kphansdge
Engager

Thank you! It's working successfully. 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...